c3a155a7cc6532cbd6a44e8751bd3ddb6c7f65bb412781cc21c813104734218b

General

Target
Watchbeam 2.1.0-Setup.exe
Size 111.7MB
Sample260815-b5bbhaxte1
SHA256 c3a155a7cc6532cbd6a44e8751bd3ddb6c7f65bb412781cc21c813104734218b
MD5 f8882db4e9cd67b9e34de3ceda77ae8f
SHA1 f5a9c045bca68984eed837aa6eb6cf62f19cb192
SHA512 d533f6d0f779c7e39c6d24df8c24bf7229c29a0b556702c32a5d3ea689e2e0b9244c0fd0f03038fd9a99a436e9cb726096bde58f6cb2b04d5b8f4e31cecb89d9
SSDEEP 1572864:H50MtZH3OZdL/Acwrq6Q6oTqBvUO6QcMD82TrcTTwh60sjO7S+th2pdllKqm5/5k:K+ZXq9/AcwuErvU2DjcfwvsjKSIOTKW
TLSH
T13F483356E2FD00E8E57BC0B8C6575517EBB2344917309BEB56A08A652F37BE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Watchbeam 2.1.0-Setup.exe
- Size 111.7MB
- SHA256 c3a155a7cc6532cbd6a44e8751bd3ddb6c7f65bb412781cc21c813104734218b
- MD5 f8882db4e9cd67b9e34de3ceda77ae8f
- SHA1 f5a9c045bca68984eed837aa6eb6cf62f19cb192
- SHA512 d533f6d0f779c7e39c6d24df8c24bf7229c29a0b556702c32a5d3ea689e2e0b9244c0fd0f03038fd9a99a436e9cb726096bde58f6cb2b04d5b8f4e31cecb89d9
- SSDEEP 1572864:H50MtZH3OZdL/Acwrq6Q6oTqBvUO6QcMD82TrcTTwh60sjO7S+th2pdllKqm5/5k:K+ZXq9/AcwuErvU2DjcfwvsjKSIOTKW
- TLSH
  T13F483356E2FD00E8E57BC0B8C6575517EBB2344917309BEB56A08A652F37BE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence ransomware spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1